COURSE of the MONTH

Restore deleted file which is still open.

We deleted (rm) a file that was (is) open by a 24/7 process.
We have a backup of this file and want to copy it over to the original location.

Scenario:
1) Process P has file F open.
2) cp F /tmp/F
3) rm F

We cannot "stop" process "P", but would like to restore the "F" file to it's original location.
What would be the consequences to the "P" process? would it fail? would it take the file as nothing had happened?

Who is Participating?

From my understanding, the file space will not be released till that process is killed / stopped.

When a process opens a file it get a file descriptor which is pointing to a vnode (virtual node) in memory which points to inode on disk.

A dir is nothing but a special file that contains a table (in my opinion) which has rows of entries, each entry is a file name and an inode number. inode is a structure that contains info about the file on the disk. a file is deleted from a dir by removing that entry in the table, and is removed from a hard disk or file system when the number of dirs references to it becomes 0.

When you delete a file from a dir you are simply decrementing the number of references to it. The file could have other references in the same dir or some other dir (this is in the context of the same file system and is called a hard link).

Now, when you copy / restore / recreate a file with the same name in the same dir, it will get a different inode number and hence has nothing to do with the previous one of the same name.

Placing the file in the same location with the same name, in your case, will help if the process closes and reopen the file. The data written between the removal, the file restore from backup, and file reopen, is going somewhere else and not to this restored file.

if process P has the file open then it has a file descriptor that points to an inode which is deleted, so it should see an error when it writes to it. Then it depends on the code of the process if it attempts to reopen the file for write again.

You may avoid accidental delete of file by having another hard link to it, use ln command

Thanks for your reply.
I have to admit I have limited knowlege of Unix.

As I understand it, when a process is executing an has a file open, if the file is removed (rm) unix will not actually release the space, but allow the process to continue using the (now deleted) file.

That is the situation here: the file was removed and the process still believes it's available. Now we need to actually place the backup in the right location so the process may actually find it if it attempts to close/reopen this file.